53328: completion options update

16 files changed, 309 insertions, 64 deletions

diff --git a/Completion/Linux/Command/_cpupower b/Completion/Linux/Command/_cpupower
index d342b69d9..cb6f37fb0 100644
--- a/Completion/Linux/Command/_cpupower
+++ b/Completion/Linux/Command/_cpupower
@@ -20,7 +20,6 @@ cmds=(
   'info:show global power parameters'
   'set:set global power parameters'
   'monitor:report frequency and idle statistics'
-  'powercap-info:show powercapping related kernel and hardware configurations'
   'help:print usage information'
 )
 case $state in
diff --git a/Completion/Linux/Command/_cryptsetup b/Completion/Linux/Command/_cryptsetup
index f7149a76f..897eb94f9 100644
--- a/Completion/Linux/Command/_cryptsetup
+++ b/Completion/Linux/Command/_cryptsetup
@@ -13,7 +13,7 @@ _arguments -s \
   '(-y --verify-passphrase)'{-y,--verify-passphrase}'[query for password twice]' \
   '(-d --key-file)'{-d+,--key-file=}'[set keyfile]:key file:_files' \
   '--master-key-file=[set master key]:key file:_files' \
-  '--dump-master-key[dump luks master key]' \
+  '--dump-volume-key[dump volume key instead of keyslots info]' \
   '(-s --key-size)'{-s+,--key-size=}'[set key size]:size (bits)' \
   '(-l --keyfile-size)'{-l+,--keyfile-size=}'[set keyfile size]:size (bytes)' \
   '--keyfile-offset=[specify number of bytes to skip in keyfile]:offset (bytes)' \
@@ -37,8 +37,35 @@ _arguments -s \
   '--shared[share device with another non-overlapping crypt segment]' \
   '--uuid=[set device UUID]:uuid' \
   '--allow-discards[allow discard (aka TRIM) requests for device]' \
+  '--cancel-deferred[cancel previously set deferred device removal]' \
+  '--disable-blkid[disable blkid on-disk signature detection and wiping]' \
+  '--disable-external-tokens[disable loading of external LUKS2 token plugins]' \
+  "--disable-veracrypt[don't scan for VeraCrypt compatible device]" \
+  '--dump-json-metadata[dump info in JSON format (LUKS2 only)]' \
+  '--dump-volume-key[dump volume key instead of keyslots info]' \
+  '--external-tokens-path=[specify path to directory with external token handlers (plugins)]:path:_directories' \
+  '--force-offline-reencrypt[force offline LUKS2 reencryption and bypass active device detection]' \
   '--header=[device or file with separated LUKS header]:file:_files' \
-  '--test-passphrase[do not activate device, just check passphrase]' \
+  '--hw-opal[use HW OPAL encryption together with SW encryption]' \
+  '--hw-opal-factory-reset[wipe WHOLE OPAL disk on luksErase]' \
+  '--hw-opal-only[use only HW OPAL encryption]' \
+  '--keep-key[do not change volume key]' \
+  '--link-vk-to-keyring=[set keyring where to link volume key]:string' \
+  '--new-keyfile=[read the key for a new slot from a file]:file:_files' \
+  '--new-key-slot=[specify slot number for new key]:slot [first free]' \
+  '--new-token-id=[token number]:number [any]' \
+  '--progress-json[print progress data in json format]' \
+  "--test-args[don't run action, just validate all command line parameters]" \
+  '--volume-key-file=[use the volume key from file]:file:_files' \
+  '--volume-key-keyring=[use the specified keyring key as a volume key]:key' \
+  '(-B --block-size)'{-B+,--block-size=}'[reencryption block size]:block size (MiB)' \
+  '(-N --new)'{-N,--new}'[create new header on not encrypted device]' \
+  '--use-directio[use direct-io when accessing devices]' \
+  '--use-fsync[use fsync after each block]' \
+  '--write-log[update log file after every block]' \
+  "--test-passphrase[don't activate device, just check passphrase]" \
+  '--token-replace[replace the current token]' \
+  '--token-type=[restrict allowed token types used to retrieve LUKS2 key]:string' \
   '--tcrypt-hidden[use hidden header (hidden TCRYPT device)]' \
   '--tcrypt-system[device is system TCRYPT drive (with bootloader)]' \
   '--tcrypt-backup[use backup (secondary) TCRYPT header]' \
@@ -118,6 +145,7 @@ case $state in
       'luksDump:dump header information'
       'tcryptDump:dump TCRYPT device information'
       'bitlkDump:dump BITLK device information'
+      'fvault2Dump:dump FVAULT2 device information'
       'luksSuspend:suspend LUKS device and wipe key'
       'luksResume:resume suspended LUKS device'
       'luksHeaderBackup:store binary backup of headers'
diff --git a/Completion/Linux/Command/_ethtool b/Completion/Linux/Command/_ethtool
index 3e3fc0b1d..8cff24e96 100644
--- a/Completion/Linux/Command/_ethtool
+++ b/Completion/Linux/Command/_ethtool
@@ -157,7 +157,7 @@ if [[ -n $state ]]; then
     _wanted files expl 'file' _files
   ;;
   rx-flow-hash)
-    _wanted flow-types expl 'flow type' compadd {tcp,udp,ah,esp,sctp}{4,6}
+    _wanted flow-types expl 'flow type' compadd {tcp,udp,ah,esp,sctp}{4,6} gtp{c{4,6}{,t},u{4,6}{,e,u,d}}
   ;;
   rule)
     _message -e ids 'rule id'
@@ -177,6 +177,9 @@ if [[ -n $state ]]; then
   hfunc)
     _message -e functions 'hash function'
   ;;
+  xfrm)
+    _wanted transformations expl transformation compadd symmetric-xor none
+  ;;
   flags)
     _message -e masks mask
   ;;
@@ -186,6 +189,9 @@ if [[ -n $state ]]; then
   power-mode-policy)
     _wanted policies expl 'policy' compadd high auto
   ;;
+  tcp-data-split)
+    _wanted states expl state compadd auto on off
+  ;;
   *)
     case ${${(Mk)opt_args:#cmd?*}[1]#cmd?-} in
     -a|--show-pause)
@@ -209,7 +215,7 @@ if [[ -n $state ]]; then
         'rx-mini[change number of ring entries for the RX Mini ring]' \
         'rx-jumbo[change number of ring entries for the RX Jumbo ring]' \
         'tx[change number of ring entries for the TX ring]' \
-        rx-buf-len cqe-size tx-push rx-push tx-push-buf-len
+        rx-buf-len tcp-data-split cqe-size tx-push rx-push tx-push-buf-len
     ;;
     -d|--register-dump)
       _values -S ' ' -w 'option' \
@@ -306,7 +312,7 @@ if [[ -n $state ]]; then
         '(weight default)equal' \
         '(equal default)weight' \
         '(equal weight)default' \
-        hkey hfunc delete
+        hkey hfunc xfrm delete
     ;;
     -f|--flash)
       if (( CURRENT == 4 )); then
diff --git a/Completion/Linux/Command/_iptables b/Completion/Linux/Command/_iptables
index 892c48710..0a901f0f2 100644
--- a/Completion/Linux/Command/_iptables
+++ b/Completion/Linux/Command/_iptables
@@ -128,6 +128,27 @@ while
       )
     ;;
     comment) args+=( '--comment[add comment to rule]:comment' ) ;;
+    connbytes)
+      args+=(
+        '--connbytes:size (min\:[max])'
+        '--connbytes-dir:packets:(original reply both)'
+        '--connbytes-mode:mode:(packets bytes avgpkt)'
+      )
+    ;;
+    connlabel)
+      args+=(
+        '--label[match if label name has been set on a connection]:label'
+        '--set[set label on connection]'
+      )
+    ;;
+    connlimit)
+      args+=(
+        --connlimit-{upto,above}:connections
+        '--connlimit-mask:prefix length'
+        --connlimit-{s,d}addr
+      )
+    ;;
+    connmark) args+=( --mark:value ) ;;
     conntrack)
       args+=(
         '--ctstate[match packet state]:state:->cfstates'
@@ -136,18 +157,69 @@ while
 	'--ctorigdst[match original destination address]:*^!:network:_hosts'
 	'--ctreplsrc[match reply source address]:*^!:network:_hosts'
 	'--ctrepldst[match reply destination address]:*^!:network:_hosts'
+        --ct{orig,repl}{src,dst}port':port:_ports'
 	'--ctstatus[match internal conntrack states]:state:(NONE EXPECTED SEEN_REPLY ASSURED)'
 	'--ctexpire[match remaining lifetime]:time'
+        '--ctdir:direction:(original reply)'
+      )
+    ;;
+    cpu) args+=( --cpu:number ) ;;
+    dccp)
+      args+=(
+        --{s,d,source-,destination-}port:port:_ports
+        '--dccp-types:type:_sequence compadd - REQUEST RESPONSE DATA ACK DATAACK CLOSEREQ CLOSE RESET SYNC SYNCACK INVALID'
+        --dccp-option:option
       )
     ;;
+    devgroup) args+=( --{src,dst}group:name ) ;;
     dscp)
       args+=(
         '--dscp[match DSCP field]:value'
 	'--dscp-class[match the DiffServ class]:class'
       )
     ;;
+    dst) args+=( --dst-len:length --dst-opts:type ) ;;
+    ecn) args+=( --ecn-{tcp-{cwr,ece},ip-ect} ) ;;
     esp) args+=( '--espspi[match SPIs in ESP header]:*^!:spi' ) ;;
+    frag)
+      args+=(
+        --fragid:id --fraglen:length
+        --frag{res,first,more,last}
+      )
+    ;;
+    hashlimit)
+      args+=(
+        --hashlimit-{upto,above,burst}:amount
+        '--hashlimit-mode:object:_sequence compadd - srcip srcport dstip dstport'
+        --hashlimit-{src,dst}mask:prefix
+        --hashlimit-name:name
+        --hashlimit-htable-size:buckets
+        --hashlimit-htable-max:entries
+        --hashlimit-htable-{expire,gcinterval}:msec
+        --hashlimit-rate-match
+        --hashlimit-rate-intervale:sec
+      )
+    ;;
+    hbh) args+=( --hbh-len:length --hbh-opts:type ) ;;
     helper) args+=( '--helper[match packets related to a conntrack-helper]:helper:(ftp)' ) ;;
+    hl) args+=( --hl-{eq,lt,gt}:value ) ;;
+    icmp) args+=( --icmp-type:type ) ;;
+    icmp6) args+=( --icmpv6-type:type ) ;;
+    iprange) args+=( --{src,dst}-range':IP range' ) ;;
+    ipv6header)
+      args+=(
+        --soft
+        '--header:header(hop dst route frag auth esp none prot)'
+      )
+    ;;
+    ipvs)
+      args+=(
+        --ipvs --vproto:protocol --vaddr:address
+        --vport{,ctl}':port:_ports'
+        '--vdir:directory:(ORIGINAL REPLY)'
+        '--vmethod:method:(GATE IPIP MASQ)'
+      )
+    ;;
     length) args+=( '--length[match packet length]:length' ) ;;
     limit)
       args+=(
@@ -164,32 +236,120 @@ while
 	'--ports[match where source and destination ports are equal]:ports:->port-list'
       )
     ;;
+    nfacct) args+=( --nfacct-name:name ) ;;
+    osf) args+=( --genre:string --{ttl,log}:level ) ;;
     owner)
       args+=(
         '--uid-owner[match packet by user id of creating process]:user id'
 	'--gid-owner[match packet by ggroup id of creating process]:group id'
 	'--pid-owner[match packet by process id of creating process]:process id:_pids'
 	'--sid-owner[match packet by session id of creating process]:session id'
-	'--cmd-owner[match packet by name of creating command]:command:_command_names -e'
+        --suppl-groups --socket-exists
       )
     ;;
     physdev)
       args+=(
         '--physdev-in[specify bridge port via which packet is received]:name'
         '--physdev-out[specify bridge port via which packet is sent]:name'
+        --physdev-is-{in,out,bridged}
       )
     ;;
     pkttype) args+=( '--pkt-type[match link-layer packet type]:type:(unicast broadcast multicast)' ) ;;
+    policy)
+      args+=(
+        '--dir:direction:(in out)'
+        '(--strict)--pol:policy:(none ipsec)'
+        '(--pol)--strict'
+        --reqid:id --spi:id
+        '--proto:encapsulation protocol:(ah esp ipcomp)'
+        '--mode:encapsulation mode:(tunnel transport)'
+        --tunnel-{src,dst}:addr --next
+      )
+    ;;
+    quota) args+=( '--quota:quota (bytes)' ) ;;
+    rateest)
+      args+=(
+        --rateest-{delta,lt,gt,eq}
+        --rateest{,1,2}:name
+        --rateest-{bps,pps}{,1,2}:value
+      )
+    ;;
+    realm) args+=( --realm:value ) ;;
+    recent)
+      args+=(
+        --name:name --r{source,dest} --mask:netmask
+        '(--rcheck --update --remove)--set'
+        '(--set --update --remove)--rcheck'
+        '(--set --rcheck --remove)--update'
+        '(--set --rcheck --update)--remove'
+        --seconds:seconds --reap --hitcount:hits --rttl
+      )
+    ;;
+    rpfilter) args+=( --loose --validmark --accept-local --invert ) ;;
+    rt)
+      args+=(
+        --rt-type:type --rt-segsleft:number --rt-len:length
+        --rt-0-{res,not-strict} --rt-0-addrs:address
+      )
+    ;;
+    sctp)
+      args+=(
+        --{s,d,source-,destination-}port:port:_ports
+        '--chunk-types:match type:(all any only):chunk type'
+      )
+    ;;
+    set)
+      args+=(
+        '--match-set:set: :flag'
+        --return-nomatch --update-counters --update-subcounters
+        --{packet,byte}s-{eq,lt,gt}:value
+      )
+    ;;
+    socket) args+=( --transparent --nowildcard --restore-skmark ) ;;
     state)
       args+=(
         '--state[match packet state]:state:->states'
       )
     ;;
+    statistic) args+=( --mode:mode --{probability,every,packet}:value ) ;;
+    string)
+      args+=(
+        '--algo:strategy:(bm kmp)'
+        --{from,to}:offset
+        --{,hex}string:pattern
+        -icase
+      )
+    ;;
+    tcp)
+      args+=(
+        --{s,d,source-,destination-}port:port:_ports
+        '--tcp-flags:mask:->tcp-flags:comp:->tcp-flags'
+        --syn --tcp-option:option
+      )
+    ;;
+    tcpmss) args+=( --mss:value ) ;;
+    time)
+      args+=(
+        --date{start,stop}:date --time{start,stop}:time
+        --{month,week}days:day
+        --contiguous --kerneltz
+      )
+    ;;
     tos) args+=( '--tos[match type of service field]:type of service:->tos' ) ;;
-    ttl) args+=( '--ttl[match type to live]:TTL value' ) ;;
+    ttl) args+=( '--ttl-'{eq,lt,gt}':TTL value' ) ;;
+    u32) args+=( '--u32:tests' ) ;;
+    udp) args+=( --{s,d,source-,destination-}port:port:_ports ) ;;
   esac
 done
 
+if (( CURRENT > 2 )); then
+  if [[ $words[CURRENT-1] = (|\\)\! && ! -prefix - ]]; then
+    args+=( '*: :compadd -S "" - -' )
+  else
+    args+=( '*:negation:(!)' )
+  fi
+fi
+
 _arguments -C -s \
   '(-)'{-h,--help}'[print program information]' \
   '(-)'{-V,--version}'[print version information]' \
@@ -211,13 +371,13 @@ _arguments -C -s \
   "($cmds -s --src --source)"{-s,--src,--source}'[specify source]:*^!:network:_sequence _hosts' \
   "($cmds -d --dst --destination)"{-d,--dst,--destination}'[specify destination]:*^!:network:_sequence _hosts' \
   "($cmds -j --jump)"{-j,--jump}'[specify rule target]:target:->targets' \
+  "($cmds -g --goto)"{-g,--goto}'[jump to chain with no return]:target:->targets' \
   "($cmds -i --in-interface)"{-i,--in-interface}'[specify interface via which packet is received]:*^!:interface:_net_interfaces' \
   "($cmds -o --out-interface)"{-o,--out-interface}'[specify interface via which packet is to be sent]:*^!:interface:_net_interfaces' \
   "($cmds -f --fragment)"{-f,--fragment}'[match second or further fragments only]' \
   "($cmds -D --delete -c --set-counters)"{-c,--set-counters}'[initialise packet and byte counters]:packets: :bytes' \
   '(-v --verbose)'{-v,--verbose}'[enable verbose output]' \
   '(-w --wait)'{-w,--wait}'[specify maximum wait to acquire xtables lock before giving up]: :_numbers -u seconds -d 1 wait' \
-  '(-W --wait-interval)'{-W,--wait-interval}'[specify wait time to try to acquire xtables lock]: :_numbers -u usecs -d "1 second" wait' \
   '(-n --numeric)'{-n,--numeric}'[print IP addresses and port numbers in numeric format]' \
   '(-x --exact)'{-x,--exact}'[expand numbers (display exact values)]' \
   '--line-numbers[print line numbers when listing]' \
diff --git a/Completion/Linux/Command/_selinux b/Completion/Linux/Command/_selinux
index a7ba68952..22d78db7d 100644
--- a/Completion/Linux/Command/_selinux
+++ b/Completion/Linux/Command/_selinux
@@ -1,4 +1,4 @@
-#compdef audit2allow audit2why avcstat chcon checkmodule checkpolicy fixfiles getpidprevcon getsebool matchpathcon newrole restorecon runcon sealert secon sedta seinfo selinuxconlist selinuxdefcon selinuxexeccon semanage semodule semodule_unpackage sepolgen sepolicy sesearch sestatus setenforce setsebool validatetrans
+#compdef audit2allow audit2why avcstat chcon checkmodule checkpolicy fixfiles getpidprevcon getsebool matchpathcon newrole restorecon runcon sealert secon sedismod sedta seinfo selinuxconlist selinuxdefcon selinuxexeccon semanage semodule semodule_unpackage sepolgen sepolicy sesearch sestatus setenforce setsebool validatetrans
 
 # encompasses checkpolicy libselinux-utils policycoreutils
 # policycoreutils-devel policycoreutils-python-utils setools-console
@@ -127,6 +127,7 @@ case $service in
       "${ign}(-h --help)"{-h,--help}'[display help information]'
       '(-U --handle-unknown)'{-U+,--handle-unknown=}'[specify how the kernel should handle unknown classes or permissions]:action:(deny allow reject)'
       '(-M --mls)'{-M,--mls}'[enable the MLS policy when checking and compiling the policy]'
+      '(-N --disable-neverallow)'{-N,--disable-neverallow}"[don't check neverallow rules]"
       '(-o --output)'{-o+,--output=}'[write a policy file]:file:_files'
       '-c+[specify the policy version]:policy version [latest]'
       ':input file:_files'
@@ -154,7 +155,6 @@ case $service in
       '--perm-map=[specify file name of perm map]:file:_files'
       '--interface-info=[specify file name of interface information]:file:_files'
       '(-x --xperms)'{-x,--xperms}'[generate extended permission rules]'
-      '--debug[leave generated modules for -M]'
       '(-w --why)'{-w,--why}'[translate SELinux audit messages into a description of why the access was denied]'
       "${ign}(-h --help)"{-h,--help}'[display help information]'
       "${ign}--version[display version information]"
@@ -193,7 +193,7 @@ case $service in
   ;;
 
   checkmodule)
-    args=(
+    args+=(
       "${ign}(-)"{-V,--version}'[show policy versions created by this program]'
       '-m[build a policy module instead of a base module]'
       '-c+[build a policy module targeting a modular policy version]:version (4-21)'
@@ -201,7 +201,7 @@ case $service in
   ;;
 
   checkpolicy)
-    args=(
+    args+=(
       '(-F --conf)'{-F,--conf}'[write policy.conf file rather than binary policy file]'
       '(-d --debug)'{-d,--debug}'[enter debug mode after loading the policy]'
       '(-S --sort)'{-S,--sort}'[sort ocontexts before writing out the binary policy]'
@@ -347,6 +347,10 @@ case $service in
     )
   ;;
 
+  sedismod)
+    args=( ':pp file:_files -g "*.pp(-.)"' )
+  ;;
+
   sedta)
     args=(
       '(-p --policy)'{-p+,--policy=}'[specify path to SELinux policy to analyze]:policy:_files'
@@ -410,7 +414,10 @@ case $service in
 
   selinuxdefcon)
     args=(
+      '-r+[specify role]:role'
       '-l+[specify mcs/mls level]:level'
+      '-s+[specify service]:service'
+      '-v[verbose output]'
       ':user:_users'
       ':context:_selinux_contexts'
     )
@@ -726,8 +733,6 @@ case $service in
       '--auditallowxperm[search auditallowxperm rules]'
       '--dontaudit[search dontaudit rules]'
       '--dontauditxperm[search dontauditxperm rules]'
-      '--neverallow[search neverallow rules]'
-      '--neverallowxperm[search neverallowxperm rules]'
       '(-T --type_trans)'{-T,--type_trans}'[search type_transition rules]'
       '--type_change[search type_change rules]'
       '--type_member[search type_member rules]'
diff --git a/Completion/Linux/Command/_sshfs b/Completion/Linux/Command/_sshfs
index 3467fbd8a..48b308066 100644
--- a/Completion/Linux/Command/_sshfs
+++ b/Completion/Linux/Command/_sshfs
@@ -15,12 +15,13 @@ _arguments -C -S : \
   '(-d --debug -f)'{-d,--debug}'[enable debug output]' \
   '-f[foreground]' \
   '-s[disable multithreaded operation]' \
+  '(-v --verbose)'{-v,--verbose}'[print ssh replies and messages]' \
   ':remote directory:_user_at_host -S:' \
   ':mountpoint:_files -/' && ret=0
 
 if [[ $state == options ]]; then
   # TODO complete ssh(1) options
-  _values -s , "options to ssh, sshfs, mount, or FUSE" \
+  _values -s , "option to ssh, sshfs, mount, or FUSE" \
     'port:number' \
     'compression: :(yes no)' \
     reconnect delay_connect sshfs_sync no_readahead sync_readdir \
@@ -42,14 +43,15 @@ if [[ $state == options ]]; then
     'ssh_protocol:version:(1 2)' \
     sftp_server:path:_files \
     directport:port:_ports \
-    slave disable_hardlink transform_symlinks follow_symlinks no_check_root password_stdin \
-    debug \
-    allow_other allow_root auto_unmount nonempty default_permissions \
+    passive disable_hardlink transform_symlinks follow_symlinks no_check_root password_stdin \
+    max_conns:number \
+    debug nonempty default_permissions \
     fsname:filesystem\ name \
     subtype:filesystem\ type \
     large_read \
     max_read:max\ size \
-    hard_remove use_ino readdir_ino direct_io kernel_cache auto_cache noauto_cache \
+    hard_remove use_ino readdir_ino direct_io \
+    kernel_cache auto_cache noauto_cache \
     'umask:permissions' \
     'uid:owner' 'gid:group' \
     'entry_timeout:timeout (seconds) [1]' \
@@ -58,6 +60,7 @@ if [[ $state == options ]]; then
     'ac_attr_timeout:timeout (seconds) [= attr_timeout]' \
     noforget \
     'remember:time (seconds)' \
+    allow_other allow_root auto_unmount \
     nopath intr \
     'intr_signal:signal [10]' \
     modules:module \
diff --git a/Completion/Linux/Command/_valgrind b/Completion/Linux/Command/_valgrind
index 5eaaea338..6bf0e4450 100644
--- a/Completion/Linux/Command/_valgrind
+++ b/Completion/Linux/Command/_valgrind
@@ -40,7 +40,7 @@ common_report_errors=(
   '--error-exitcode=-[exit code to return if errors found]:exit code' \
   '--error-markers=-[add lines with begin/end markers before/after]:markers (begin,end)' \
   '(--show-error-list)-s[show detected errors list and suppression counts at exit]' \
-  '--show-error-list=-[show detected errors list and suppression counts at exit]:enable [no]:(yes no)'
+  '--show-error-list=-[show detected errors list and suppression counts at exit]:enable [no]:(yes no all)'
   '--keep-debuginfo=-[keep symbols etc for unloaded code]:enable:(yes no)' \
   '--show-below-main=-[continue stack traces below main()]:enable [no]:(yes no)' \
   '--default-suppression=-[load default suppressions]:enable [yes]:(yes no)' \
@@ -115,6 +115,7 @@ args_memcheck=(
   $args_addrcheck
   $common_read_varinfo
   $common_report_errors
+  '--show-realloc-size-zero=-[show reallocs with a size of zero]:enable [yes]:(yes no)'
 )
 
 args_cachegrind=(
@@ -215,12 +216,13 @@ _arguments -C ${(P)args} $cmd \
   '--child-silent-after-fork=-[omit child output between fork & exec]:enable:(yes no)' \
   '--vgdb=-[activate gdbserver]:enable [yes]:(yes no full)' \
   '--vgdb-error=-[invoke gdbserver after specified number of errors]:errors [999999999]:errors' \
-  '--vgdb-stop-at=-[invoke gdbserver for given events]:event:_sequence compadd - startup exit valgrindabexit all none' \
+  '--vgdb-stop-at=-[invoke gdbserver for given events]:event:_sequence compadd - startup exit abexit valgrindabexit all none' \
   '--track-fds=-[track open file descriptors]:enable [no]:(yes no all)' \
   '--time-stamp=-[add timestamps to log messages]:enable:(yes no)' \
   '--log-fd=-[log messages to specified file descriptor]:file descriptor:_file_descriptors' \
   '--log-file=-[log messages to specified file with pid appended]:file:_files' \
   '--log-socket=-[log messages to socket]:ipaddr\:port' \
+  '--enable-debuginfod=-[query debuginfod servers for missing debuginfo]:enable [yes]:(no yes)' \
   '*--fullpath-after=-[show full source paths in call stacks]::prefix to remove from paths:_directories' \
   '--extra-debuginfo-path=-[specify absolute path to search for additional debug symbols]:path:_directories' \
   '--debuginfo-server=-[specify server to query for debug symbols]:server:_hosts' \
@@ -233,6 +235,7 @@ _arguments -C ${(P)args} $cmd \
   '--run-libc-freeres=-[free up glibc memory at exit]:enable [yes]:(yes no)' \
   '--run-cxx-freeres=-[free up libstdc++ memory at exit]:enable [yes]:(yes no)' \
   '--sim-hints=-[activate unusual sim behaviours]:hint [none]:_sequence compadd - lax-ioctls lax-doors fuse-compatible enable-outer no-inner-prefix no-nptl-pthread-stackcache fallback-llsc none' \
+  '--scheduling-quantum=-[thread-scheduling timeslice in number of basic blocks]:blocks [100000]' \
   '--fair-sched=-[schedule threads fairly on multicore systems]:enable [no]:(yes no try)' \
   '--kernel-variant=-[handle non-standard kernel variants]:kernel variant:_sequence compadd - bproc android-no-hw-tls android-gpu-sgx5xx android-gpu-adreno3xx' \
   '--merge-recursive-frames=-[merge frames between identical program counters in specified max frames]:frames [0]' \
@@ -247,6 +250,7 @@ _arguments -C ${(P)args} $cmd \
   '--unw-stack-scan-thresh=-[enable stack-scan unwind if fewer than specified number of good frames found]:frames' \
   '--resync-filter=-[attempt to avoid expensive address-space-resync operations]:enable:(yes no verbose)' \
   '--max-threads=-[specify maximum number of threads that valgrind can handle]:threads [500]' \
+  '--realloc-zero-bytes-frees=-[should calls to realloc() with a size of 0 free memory and return NULL]:enable:(yes no)' \
   && return
 
 typeset -a tools
diff --git a/Completion/Unix/Command/_abcde b/Completion/Unix/Command/_abcde
index 3f748d373..6b09d87b5 100644
--- a/Completion/Unix/Command/_abcde
+++ b/Completion/Unix/Command/_abcde
@@ -21,7 +21,7 @@ _arguments -s -S -A "-*" \
   '-m[create DOS-style playlists, modifying the resulting one by adding CRLF line endings those to work]' \
   "-n[don't query CDDB database]" \
   '-N[non interactive mode]' \
-  '-o+[select output type]:output type [vorbis]:(vorbis ogg mp3 flac spx mpc m4a wav wv ape opus mka aiff)' \
+  '-o+[select output type]:output type [vorbis]:_sequence compadd - vorbis ogg mp3 flac spx mpc m4a wav wv ape opus mka aiff' \
   "-p[pads track numbers with 0's]" \
   '-P[use Unix PIPES to read and encode in one step]' \
   '-Q+[specify CD lookup methods]:lookup method [musicbrainz]:_sequence compadd - musicbrainz cddb cdtext' \
diff --git a/Completion/Unix/Command/_dig b/Completion/Unix/Command/_dig
index c09bebbe5..440c5de90 100644
--- a/Completion/Unix/Command/_dig
+++ b/Completion/Unix/Command/_dig
@@ -5,8 +5,8 @@ local -a alts args
 [[ -prefix + ]] && args=(
   '*+'{no,}'tcp[use TCP instead of UDP for queries]'
   '*+'{no,}'ignore[ignore truncation in UDP responses]'
-  '*+domain=[set search list to single domain]:domain:_hosts'
-  '!*+dscp=:code point (0..63)'
+  '*+domain=-[set search list to single domain]:domain:_hosts'
+  '!*+dscp=-:code point (0..63)'
   '*+'{no,}'search[use search list defined in resolv.conf]'
   '!*+'{no,}defname
   '*+'{no,}'showsearch[show intermediate results in domain search]'
@@ -20,27 +20,26 @@ local -a alts args
   '*+'{no,}'cookie[add a COOKIE option to the request]'
   '*+'{no,}'crypto[display cryptographic fields in DNSSEC records]'
   '*+'{no,}'dns64prefix[get the DNS64 prefixes from ipv4only.arpa]'
-  '*+edns=[specify EDNS version for query]:version (0-255)'
+  '*+edns=-[specify EDNS version for query]:version (0-255)'
   '*+noedns[clear EDNS version to be sent]'
-  '*+ednsflags=[set EDNS flags bits]:flags'
+  '*+ednsflags=-[set EDNS flags bits]:flags'
   '*+'{no,}'ednsnegotiation[set EDNS version negotiation]'
-  '*+ednsopt=[specify EDNS option]:code point'
+  '*+ednsopt=-[specify EDNS option]:code point'
   '*+noedns[clear EDNS options to be sent]'
   '*+'{no,}'expandaaaa[expand AAAA records]'
   '*+'{no,}'expire[send an EDNS Expire option]'
   '*+'{no,}'header-only[send query without a question section]'
-  '*+'{no,}'https=[DNS-over-HTTPS POST mode]::endpoint [/dns-query]'
-  '!*+'{no,}'https-post=::endpoint [/dns-query]'
-  '*+'{no,}'https-get=[DNS-over-HTTPS GET mode]::endpoint [/dns-query]'
-  '*+'{no,}'http-plain=[DNS-over-HTTP POST mode]::endpoint [/dns-query]'
-  '*+'{no,}'http-plain-get=[DNS-over-HTTP GET mode]::endpoint [/dns-query]'
-  '*+'{no,}'idnin[set processing of IDN domain names on input]'
-  '*+'{no,}'idnout[set conversion of IDN puny code on output]'
+  '*+'{no,}'https=-[DNS-over-HTTPS POST mode]::endpoint [/dns-query]'
+  '!*+'{no,}'https-post=-::endpoint [/dns-query]'
+  '*+'{no,}'https-get=-[DNS-over-HTTPS GET mode]::endpoint [/dns-query]'
+  '*+'{no,}'http-plain=-[DNS-over-HTTP POST mode]::endpoint [/dns-query]'
+  '*+'{no,}'http-plain-get=-[DNS-over-HTTP GET mode]::endpoint [/dns-query]'
+  '*+'{no,}'idn[convert international domain names]'
   '*+'{no,}'keepalive[request EDNS TCP keepalive]'
   '*+'{no,}'keepopen[keep TCP socket open between queries]'
   '*+'{no,}'recurse[set the RD (recursion desired) bit in the query]'
   '*+'{no,}'nssearch[search all authoritative nameservers]'
-  '*+opcode[set DNS message opcode of the request]:opcode [QUERY]:(QUERY IQUERY STATUS NOTIFY UPDATE)'
+  '*+opcode=-[set DNS message opcode of the request]:opcode [QUERY]:(QUERY IQUERY STATUS NOTIFY UPDATE)'
   '*+noopcode[clear DNS message opcode]'
   '*+'{no,}'trace[trace delegation down from root]'
   '*+'{no,}'cmd[print initial comment in output]'
@@ -50,7 +49,9 @@ local -a alts args
   '*+'{no,}'comments[print comment lines in output]'
   '*+'{no,}'stats[print statistics]'
   '*+padding[set padding block size]:size [0]'
-  '*+qid=[specify query ID]:query ID'
+  '*+'{no,}'proxy=-[add PROXYv2 headers to queries]:src_addr[#src_port]-dst_addr[#dst_port]'
+  '*+'{no,}'proxy-plain=-[add PROXYv2 headers to queries ahead of any encryption]:src_addr[#src_port]-dst_addr[#dst_port]'
+  '*+qid=-[specify query ID]:query ID'
   '*+'{no,}'qr[print query as it was sent]'
   '*+'{no,}'question[print question section of a query]'
   '*+'{no,}'raflag[set RA flag in the query]'
@@ -59,17 +60,17 @@ local -a alts args
   '*+'{no,}'all[set all print/display flags]'
   '*+'{no,}'subnet[send EDNS client subnet option]:addr/prefix-length'
   '*+'{no,}'tcflag[set TC flag in the query]'
-  '*+timeout=[set query timeout]:timeout (seconds) [5]'
+  '*+timeout=-[set query timeout]:timeout (seconds) [5]'
   '*+'{no,}'tls[DNS-over-TLS mode]'
-  '*+'{no,}"tls-ca=[enable remote server's TLS certificate validation]:file:_files"
-  '*+'{no,}"tls-hostname=[explicitly set the expected TLS hostname]:hostname"
-  '*+'{no,}'tls-certfile=[load client TLS certificate chain from file]:file:_files'
-  '*+'{no,}'tls-keyfile=[load client TLS private key from file]:file:_files'
-  '*+tries=[specify number of UDP query attempts]:tries'
-  '*+retry=[specify number of UDP query retries]:retries'
+  '*+'{no,}"tls-ca=-[enable remote server's TLS certificate validation]:file:_files"
+  '*+'{no,}"tls-hostname=-[explicitly set the expected TLS hostname]:hostname"
+  '*+'{no,}'tls-certfile=-[load client TLS certificate chain from file]:file:_files'
+  '*+'{no,}'tls-keyfile=-[load client TLS private key from file]:file:_files'
+  '*+tries=-[specify number of UDP query attempts]:tries'
+  '*+retry=-[specify number of UDP query retries]:retries'
   '*+'{no,}'rrcomments[set display of per-record comments]'
-  '*+ndots=[specify number of dots to be considered absolute]:dots'
-  '*+bufsize=[specify UDP buffer size]:size (bytes)'
+  '*+ndots=-[specify number of dots to be considered absolute]:dots'
+  '*+bufsize=-[specify UDP buffer size]:size (bytes)'
   '*+'{no,}'multiline[verbose multi-line output]'
   '*+'{no,}'onesoa[AXFR prints only one soa record]'
   '*+'{no,}"fail[don't try next server on SERVFAIL]"
diff --git a/Completion/Unix/Command/_flac b/Completion/Unix/Command/_flac
index 1773061ee..0197aaf92 100644
--- a/Completion/Unix/Command/_flac
+++ b/Completion/Unix/Command/_flac
@@ -14,9 +14,11 @@ shortops=(
   --show-total-samples
   --show-vendor-tag
   '--show-tag=:FLAC tag'
+  '--show-all-tags'
   '--remove-tag=:FLAC tag'
   '--remove-first-tag=:FLAC tag'
   --remove-all-tags
+  '--remove-all-tags-except=:tag'
   '*--set-tag=:FLAC tag and value: '
   '*--set-tag-from-file=:tag'
   '--import-tags-from=:flat file:_files'
@@ -60,7 +62,7 @@ case $service in
       '(H)--until=[stop at specified sample for each input]:stop (+-mm:ss.ss)' \
       '(H)--ogg[use ogg as a transport layer]' \
       '(H)--serial-number=[serial number to use for the FLAC stream]:serial number' \
-      '(H --force-aiff-format --force-rf64-format --force-wave64-format)--format-raw-format' \
+      '(H --force-aiff-format --force-rf64-format --force-wave64-format --force-legacy-wave-format --force-extensible-wave-format --force-aiff-c-none-format --force-aiff-c-sowt-format)--force-raw-format' \
       '*:file:_files -F line -g "(#i)*.(${${opt_args[(i)decode-*]:+flac|oga}:-wav|aif|aiff|raw|rf64|w64})(-.)"' \
       - 'H' \
       '(-)'{-v,--version}'[display version information]' \
@@ -100,9 +102,13 @@ case $service in
       '(-F --decode-through-errors)'{-F,--decode-through-errors}'[continue decoding through stream errors]' \
       '--apply-replaygain-which-is-not-lossless=:specification' \
       '--cue=[set the beginning and ending cuepoints to decode]:cue point' \
-      '(--force-raw-format --force-rf64-format --force-wave64-format)--force-aiff-format' \
-      '(--force-raw-format --force-aiff-format --force-wave64-format)--force-rf64-format' \
-      '(--force-raw-format --force-aiff-format --force-rf64-format)--force-wave64-format' \
+      '(--force-raw-format --force-rf64-format --force-wave64-format --force-legacy-wave-format --force-extensible-wave-format --force-aiff-c-none-format --force-aiff-c-sowt-format)--force-aiff-format' \
+      '(--force-raw-format --force-aiff-format --force-wave64-format --force-legacy-wave-format --force-extensible-wave-format --force-aiff-c-none-format --force-aiff-c-sowt-format)--force-rf64-format' \
+      '(--force-raw-format --force-aiff-format --force-rf64-format --force-legacy-wave-format --force-extensible-wave-format --force-aiff-c-none-format --force-aiff-c-sowt-format)--force-wave64-format' \
+      '(--force-raw-format --force-aiff-format --force-rf64-format --force-wave64-format --force-extensible-wave-format --force-aiff-c-none-format --force-aiff-c-sowt-format)--force-legacy-wave-format' \
+      '(--force-raw-format --force-aiff-format --force-rf64-format --force-wave64-format --force-legacy-wave-format --force-aiff-c-none-format --force-aiff-c-sowt-format)--force-extensible-wave-format' \
+      '(--force-raw-format --force-aiff-format --force-rf64-format --force-wave64-format --force-legacy-wave-format --force-extensible-wave-format --force-aiff-c-sowt-format)--force-aiff-c-none-format' \
+      '(--force-raw-format --force-aiff-format --force-rf64-format --force-wave64-format --force-legacy-wave-format --force-extensible-wave-format --force-aiff-c-none-format)--force-aiff-c-sowt-format'
   ;;
   metaflac)
     _arguments -S $shared \
@@ -112,10 +118,11 @@ case $service in
       "*:FLAC file:_files -g \*.flac\(-.\)" \
       - 'short' $shortops \
       - 'list' $common --list \
+      '--data-format=:format:(binary binary-headerless text)' \
       '--application-data-format=:format:(text hexdump)' \
       - 'remove' $common --remove \
       - '(ops)' \
       '(-)--help' '(-)--version' \
-      --remove-all --merge-padding --sort-padding
+      --append --remove-all --merge-padding --sort-padding
   ;;
 esac
diff --git a/Completion/Unix/Command/_gnutls b/Completion/Unix/Command/_gnutls
index 9b8bcf6ea..4c1698857 100644
--- a/Completion/Unix/Command/_gnutls
+++ b/Completion/Unix/Command/_gnutls
@@ -24,6 +24,7 @@ case "$service" in
   gnutls-cli*)
     args+=(
       '(--app-proto --starttls-proto)'{--app-proto,--starttls-proto}"=[specify application protocol to use to obtain the server's certificate]:protocol:(https ftp smtp imap ldap xmpp lmtp pop3 nntp sieve postgres)"
+      '(-s --starttls)--starttls-name=[specify hostname presented to the application protocol for STARTTLS]:hostname'
      ':hostname:_hosts'
     )
   ;|
@@ -99,7 +100,7 @@ case "$service" in
       '--post-handshake-auth[enable post-handshake authentication under TLS1.3]'
       '--inline-commands[inline commands of the form ^<cmd>^]'
       '--inline-commands-prefix=[change delimiter used for inline commands]:delimiter [^]'
-      '--fips140-mode[report status of FIPS140-3 mode in gnutls library]'
+      '--fips140-mode[report status of FIPS140-2 mode in gnutls library]'
       '--list-config[report configuration of the library]'
       '--logfile=[redirect informational messages to a specific file]:file:_files'
       '--waitresumption[block waiting for the resumption data under TLS1.3]'
@@ -202,9 +203,11 @@ case "$service" in
       '--seed=[when generating a private key use the given seed]:seed (hex-encoded)'
       '--pubkey-info[print information on a public key]'
       '--to-p12[generate a PKCS #12 structure]'
+      '--pbmac1[use PBMAC1 in a PKCS #12 structure]'
       '(-8 --pkcs8)'{-8,--pkcs8}'[use PKCS #8 format for private keys]'
       '--hash=[specify hash algorithm for signing]:algorithm:(MD5 SHA1 RMD160)'
       '--salt-size=[specify the RSA-PSS key default salt size]:size'
+      '--label=[specify the RSA-OAEP label, encoded in hexadecimal]:label'
       {--inder,--inraw}'[use DER format for input certificates and private keys]'
       {--outder,--outraw}'[use DER format for output certificates and private keys]'
       '--template=[specify template file to use for non-interactive operation]:file:_files'
diff --git a/Completion/Unix/Command/_jq b/Completion/Unix/Command/_jq
index b8e41dd66..e8e6b0913 100644
--- a/Completion/Unix/Command/_jq
+++ b/Completion/Unix/Command/_jq
@@ -1,6 +1,7 @@
 #compdef jq
 
-# last updated for jq-1.5-1-a5b5cbe (debian package 1.5+dfsg-1.3)
+local ign
+(( $#words > 2 )) && ign='!'
 
 # Note:
 #   Arguments to options must be in separate words.  Thus,
@@ -8,23 +9,27 @@
 #   is correct like that, without the usual {-f+,--from-file=} suffixes.
 #
 _arguments -S -s : \
-  "--version[output jq's version number]" \
+  "${ign}(- 1 *)"{-V,--version}'[display version information]' \
+  "${ign}(- 1 *)"{-h,--help}'[display help information]' \
+  "${ign}(- 1 *)--build-configuration[display jq's build configuration]" \
   "--seq[use application/json-seq ASCII RS/LF scheme in input and output]" \
-  "--stream[parse input streamily (changes output)]" \
-  '(-s --slurp)'{-s,--slurp}'[join input JSON objects to array before filtering]' \
-  '(-R --raw-input)'{-R,--raw-input}'[consider each input line as a JSON strings]' \
-  '(-n --null-input)'{-n,--null-input}'[input is ignored]' \
+  "(--stream-errors -n --null-input)--stream[parse the input value in streaming fashion]" \
+  '(--stream -n --null-input)--stream-errors[parse the input value in streaming fashion with errors as an array]' \
+  '(-s --slurp -n --null-input)'{-s,--slurp}'[read all inputs into an array and use it as single input value]' \
+  '(-R --raw-input -n --null-input)'{-R,--raw-input}'[read each line as string instead of JSON]' \
+  '(-n --null-input --stream --stream-errors -s --slurp -R --raw-input)'{-n,--null-input}'[use `null` as the single input value]' \
   '(-c --compact-output)'{-c,--compact-output}"[don't pretty-print]" \
   '(--indent)--tab[indent output using TAB characters]' \
-  '(--tab)--indent[indent output using given number of spaces]:number of spaces (integer):(2 4 8)' \
+  '(--tab)--indent[indent output using given number of spaces]:number of spaces (integer):(-1 0 1 2 3 4 5 6 7)' \
   '(-C --color-output -M --monochrome-output)'{-C,--color-output}'[output in color]' \
   '(-C --color-output -M --monochrome-output)'{-M,--monochrome-output}'[output without color]' \
-  '(-a --ascii-output)'{-a,--ascii-output}'[restrict output to ASCII]' \
+  '(-a --ascii-output)'{-a,--ascii-output}'[restrict output to ASCII using escape sequences]' \
   '--unbuffered[flush output after each JSON object]' \
   '(-S --sort-keys)'{-S,--sort-keys}'[output object keys in sorted order]' \
-  '(-r --raw-output -j --join-output)'{-r,--raw-output}"[don't JSON-quote output if it's a string]" \
-  '(-r --raw-output -j --join-output)'{-j,--join-output}"[like -r, without newlines between outputs]" \
-  '(-f --from-file)'{-f,--from-file}'[read filter from file]:_files' \
+  '(-r --raw-output -j --join-output --raw-output0)'{-r,--raw-output}"[don't JSON-quote output if it's a string]" \
+  '(-r --raw-output -j --join-output)--raw-output0[like -r, with NUL after each output]' \
+  '(-r --raw-output --raw-output0 -j --join-output)'{-j,--join-output}"[like -r, without newlines between outputs]" \
+  '(-f --from-file)'{-f,--from-file}'[read filter from file]: :_files' \
   '-L+[prepend a directory to the module search path]:_directories' \
   '(-e --exit-status)'{-e,--exit-status}'[report "false" and "null" results via exit code]' \
   '*--arg[pre-set a variable to a string]:variable name: :value (string)' \
diff --git a/Completion/Unix/Command/_pv b/Completion/Unix/Command/_pv
index b21625650..0e1f148d5 100644
--- a/Completion/Unix/Command/_pv
+++ b/Completion/Unix/Command/_pv
@@ -20,6 +20,7 @@ _arguments -s -S $args \
   '(-m --average-rate-window)'{-m+,--average-rate-window=}'[compute average rate over period]:duration (seconds) [30]' \
   '(-b --bytes -8 --bits -F --format)'{-b,--bytes}'[show number of bytes transferred]' \
   '(-8 --bits -b --bytes -F --format)'{-8,--bits}'[show number of bits transferred]' \
+  '(-k --si)'{-k,--si}'[treat suffixes as multiples of 1000 rather than 1024]' \
   '(-T --buffer-percent -F --format)'{-T,--buffer-percent}'[show percentage of transfer buffer in use]' \
   '(-A --last-written -F --format)'{-A+,--last-written=}'[show number of bytes last written]:number (bytes)' \
   '(-F --format -p --progress -t --timer -e --eta -I --fineta -r --rate -a --average-rate -b --bytes -T --buffer-percent -A --last-written -F --format)'{-F+,--format=}'[set output format]:format:->formats' \
@@ -28,19 +29,29 @@ _arguments -s -S $args \
   '(-W --wait)'{-W,--wait}'[display nothing until first byte transferred]' \
   '(-D --delay-start -R --remote)'{-D+,--delay-start=}'[display nothing until delay has passed]:delay (seconds)' \
   '(-s --size)'{-s+,--size=}'[set estimated data size]: :_numbers -u bytes size K M G T' \
+  '(-g --gauge)'{-g,--gauge}'[if size unknown, show rate vs max rate]' \
   '(-l --line-mode -R --remote)'{-l,--line-mode}'[count lines instead of bytes]' \
   '(-0 --null -l --line-mode)'{-0,--null}'[lines are null-terminated]' \
   '(-i --interval)'{-i+,--interval=}'[update every after specified interval]:interval (seconds) [1]' \
+  '(-m --average-rate-window)'{-m,--average-rate-window}'[compute average rate over past period]:period (seconds) [30]' \
   '(-w --width)'{-w+,--width}'[assume terminal is specified characters wide]:width' \
   '(-H --height)'{-H+,--height=}'[assume terminal is specified rows high]:height' \
   '(-N --name)'{-N+,--name=}'[prefix visual information with given name]:name' \
+  '(-x --extra-display)'{-x+,--extra-display=}'[also send progress to destination]:destination:_sequence - compadd windowtitle processtitle' \
+  '(-v --stats)'{-v,--stats}'[output transfer statistics at the end]' \
   '(-f --force -R --remote)'{-f,--force}'[output even if standard error is not a terminal]' \
   '(-c --cursor -R --remote)'{-c,--cursor}'[use cursor positioning escape sequences]' \
+  '(-o --output)'{-o+,--output=}'[write output to file instead of stdout]:file:_files' \
   '(-L --rate-limit)'{-L+,--rate-limit=}'[limit transfer rate]: :_numbers -u "bytes per second" rate K M G T' \
   '(-B --buffer-size)'{-B+,--buffer-size=}'[use a buffer size of given size]: :_numbers -u bytes size K M G T' \
   '(-C --no-splice)'{-C,--no-splice}'[never use splice(), always use read/write]' \
   '(-R --remote)*'{-E,--skip-errors}"[skip read errors in input${Edesc}]" \
+  '(-Z --error-skip-block)'{-Z+,--error-skip-block=}'[skip whole blocks on errors]: :_numbers -u bytes "block size" K M G T' \
   '(-S --stop-at-size -R --remote)'{-S,--stop-at-size}'[stop after --size bytes have been transferred]' \
+  '(-Y --sync)'{-Y,--sync}'[flush cache to disk after every write]' \
+  '(-K --direct-io)'{-K,--direct-io}'[use direct I/O to bypass cache]' \
+  '(-X --discard)'{-X,--discard}'[discard input instead of writing to output]' \
+  '(-U --store-and-forward)'{-U+,--store-and-forward=}'[write all input to file before writing to output]:file:_files' \
   '(-R --remote -c --cursor -l --line-mode -f --force -D --delay-start -E --skip-errors -S --stop-at-size)'{-R+,--remote=}'[update settings of specified process]:process:_pids -m pv' \
   '(-P --pidfile)'{-P+,--pidfile=}'[save process id in a file]:file:_files' \
   "${ign}(- *)"{-h,--help}'[display usage information]' \
diff --git a/Completion/Unix/Command/_sqlite b/Completion/Unix/Command/_sqlite
index 6f0b1de94..a83624083 100644
--- a/Completion/Unix/Command/_sqlite
+++ b/Completion/Unix/Command/_sqlite
@@ -56,6 +56,7 @@ options+=(
   $^dashes'-newline[set output row separator]:separator [\n]'
   $^dashes'-nofollow[refuse to open symbolic links to database files]'
   $^dashes'-nonce[set the safe-mode escape nonce]:string'
+  $^dashes'-no-rowid-in-view[disable rowid-in-view using sqlite3_config()]'
   $^dashes'-pagecache[specify size and number of slots for page cache memory]:size (bytes): :slots'
   $^dashes'-pcachetrace[trace all page cache operations]'
   $^dashes'-readonly[open the database read-only]'
@@ -63,6 +64,7 @@ options+=(
   $^dashes'-stats[print memory stats before each finalize]'
   $^dashes'-unsafe-testing[allow unsafe commands and modes for testing]'
   $^dashes'-vfs[use specified default VFS]:vfs:(unix-dotfile unix-excl unix-none unix-namedsem)'
+  $^dashes'-vfstrace[enable tracing of all VFS calls]'
   $^dashes'-zip[open the file as a ZIP Archive]'
 )
 
diff --git a/Completion/Unix/Command/_ssh b/Completion/Unix/Command/_ssh
index 5e6e60573..d8c27c65f 100644
--- a/Completion/Unix/Command/_ssh
+++ b/Completion/Unix/Command/_ssh
@@ -62,7 +62,7 @@ _ssh () {
       '(-v)*-q[quiet operation]' \
       '*-R+[specify remote port forwarding]:remote port forwarding:->forward' \
       '-S+[specify location of control socket for connection sharing]:path to control socket:_files' \
-      '-Q+[query parameters]:query option:((cipher\:"supported symmetric ciphers" cipher-auth\:"supported symmetric ciphers that support authenticated encryption" compression mac\:"supported message integrity codes" kex\:"key exchange algorithms" kex-gss\:"GSSAPI key exchange algorithms" key\:"key types" key-cert\:"certificate key types" key-plain\:"non-certificate key types" key-sig\:"all key types and signature algorithms" protocol-version\:"supported SSH protocol versions" sig\:"supported signature algorithms" help\:"show supported queries" HostbasedAcceptedAlgorithms HostKeyAlgorithms KexAlgorithms MACs PubkeyAcceptedAlgorithms))' \
+      '(- 1 *)-Q+[query parameters]:query option:((cipher\:"supported symmetric ciphers" cipher-auth\:"supported symmetric ciphers that support authenticated encryption" compression mac\:"supported message integrity codes" kex\:"key exchange algorithms" kex-gss\:"GSSAPI key exchange algorithms" key\:"key types" key-cert\:"certificate key types" key-plain\:"non-certificate key types" key-sig\:"all key types and signature algorithms" protocol-version\:"supported SSH protocol versions" sig\:"supported signature algorithms" help\:"show supported queries" HostbasedAcceptedAlgorithms HostKeyAlgorithms KexAlgorithms MACs PubkeyAcceptedAlgorithms))' \
       '-s[invoke subsystem]' \
       '(-t)-T[disable pseudo-tty allocation]' \
       "(-T)*-t[force pseudo-tty allocation${tdesc}]" \
@@ -280,6 +280,7 @@ _ssh () {
       '-O+[specify a key/value option]: : _values option
         "hashalg[select a hash algorithm to use with -D]\:algorithm [both]\:(sha1 sha256)"' \
       '-p+[specify port on remote host]:port number on remote host' \
+      "-q[don't print server host name and banners in comments]" \
       '-T+[specify timeout]: :_numbers -u seconds -d 5 timeout \:s\:seconds m\:minutes h\:hours d\:days w\:weeks' \
       '-t+[specify key types to fetch from scanned hosts]:key type:_sequence compadd - rsa dsa ecdsa ed25519' \
       '-v[verbose mode]'
@@ -300,9 +301,13 @@ _ssh () {
     _arguments \
       '-i+[select identity file]:SSH identity file:_files -g "*(-.^AR)"' \
       '-f[copy keys without trying to check if they are already installed]' \
+      '-F+[specify alternate config file]:config file:_files' \
       '-n[dry run - no keys are actually copied]' \
       '*-o+[specify ssh options]:option string:->option' \
       '-p+[specify port on remote host]:port number on remote host' \
+      '-s[upload public keys with sftp]' \
+      '-t+[specify path on target system]:path [.ssh/authorized_keys]' \
+      '-x[debug script by turning on command tracing]' \
       '(- 1)'{-h,-\?}'[display usage information]' \
       ':remote host name:->userhost' && ret=0
     ;;
@@ -359,6 +364,10 @@ _ssh () {
         (#i)canonicalizepermittedcnames=*)
           _message -e 'CNAME rule list (source_domain_list:target_domain_list, each pattern list comma separated)' && ret=0
           ;;
+        (#i)channeltimeout=*)
+          _values 'channel type' \
+            {agent-connection,direct-tcpip,forwarded-tcpip,session,tun-connection,x11-connection}:interval:'_numbers -u seconds timeout :s:seconds m:minutes h:hours d:days w:weeks' && ret=0
+          ;;
         (#i)ciphers=*)
           state=ciphers
           ;;
@@ -584,6 +593,7 @@ _ssh () {
                 CanonicalizePermittedCNAMEs \
                 CASignatureAlgorithms \
                 CertificateFile \
+                ChannelTimeout \
                 CheckHostIP \
                 Ciphers \
                 ClearAllForwardings \
diff --git a/Completion/X/Command/_zeal b/Completion/X/Command/_zeal
index 334331d40..024b8c381 100644
--- a/Completion/X/Command/_zeal
+++ b/Completion/X/Command/_zeal
@@ -8,6 +8,7 @@ _arguments -S \
   ':query:->queries' \
   + '(opt)' \
   {-h,--help}'[display help information]' \
+  --help-all'[display help, including generic Qt options]' \
   {-v,--version}'[display version information]' \
   {-f,--force}'[force the application to run]' && ret=0